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REMARKS 

1 . In response to the Office Action mailed October 3 1 , 2007, Applicants respectfully request 
reconsideration. Claims 1-4, 9, 13, 14, 16, 17 and 21-30 were last presented in the application. 
In the outstanding Office Action, all claims were rejected. By the foregoing amendments, claims 

1. 14, 17 and 30 have been amended. No claims have been cancelled or added. Thus, upon entry 
of this paper, claims 1-4, 9, 13, 14, 16, 17 and 21-30 will remain pending in this application. Of 
these nineteen (19) claims, four (4) claims (claims 1, 14, 17 and 30) are independent. 

2. Based on the above Amendments and following Remarks, Applicants respectfully request 
that all outstanding rejections be reconsidered, and that they be withdrawn. 

Claim Rejections 

3. The Examiner has rejected claim 30 under 35 U.S.C. Section 102(a) as anticipated by 
"Otter: A General Purpose Network Visualization Tool," June 3, 2000, ISOC Inet 99 (Huffaker 
et al ), (hereinafter, "Huffaker"). Similarly, the Examiner has rejected claims 1-4, 9-14, 16-19 
and 21-26 under 35 U.S.C. Section 103(a) as being unpatentable over Huffaker in view of U.S. 
Patent No. 7,127,743 to Khanolkar et al, (hereinafter, "Khanolkar"). Reconsideration is 
respectfully requested. 

The Rejection of Claim 1 under 35 U.S.C §103 is Prima Facie Improper 

4. Referring specifically to claim 1, the Examiner recognizes that Huffaker fails to teach 
"filter criteria, including a selection of at least one of the network device types and at least one of 
said status levels" as recited, in part, in Applicants' claim 1. (See, Office Action, pages 4-5.) In 
the Office Action, the Examiner relies upon Khanolkar to teach the "filter criteria" elements 
which are missing from Huffaker. (See, Office Action, page 5.) The Examiner then asserts that 
"it would have been obvious at the time of invention to one of ordinary skill in the art to create 
the visual representation of the network as taught by Khanolkar because it would allow the user 
to focus on a particular set of devices." (See, Office Action, pages 4-5.) 

5. Applicants respectfully request that the Examiner reconsider and withdraw the rejection 
for at least the following two reasons. First, the Examiner has failed to provide an appropriate 
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basis for combining the cited references. Second, even if the references were combined as 
suggested by the Examiner, the proposed combination would still not contain all the elements of 
Applicants' claim 1. 

The Examiner has Failed to Properly Support the Proposed Combination 

6. This rejection of claim 1 is prima facie improper because it provides no appropriate basis 
for combining Khanolkar with Huffaker. As recently stated by the Supreme Court, "a patent 
composed of several elements is not proved obvious merely by demonstrating that each of its 
elements was, independently known in the prior art." (See KSR International Co. v. Teleflex 
Inc., 127 S.Ct. 1727, 1741 (2007).) Moreover, the Supreme Court recognized in KSR that 
"rejections on obviousness grounds cannot be sustained by mere conclusory statements; instead, 
there must be some articulated reasoning with some rational underpinning to support the legal 
conclusion of obviousness ." (See KSR, 127 S.Ct. at 1741 (citing In re Kahn, 441 F.3d 977, 988 
(C.A.Fed. 2006).) 

7. Applicants submit that the Examiner has completely failed to satisfy these legal 
obligations in the rejection of claim 1 under 35 U.S.C. §103. In particular, the Examiner has 
done what has been viewed as circumspect by the Supreme Court, and has merely provided a 
unsupported statement to justify the proposed combination. 

8. Huffaker describes a tool for visualizing network data "expressed as a set of nodes, links 
or paths." (See, Huffaker, Abstract.) In Huffaker, the nodes and paths are displayed via a 
viewing window so that a network manager may visualize the topology of the network. (See, 
Huffaker, Abstract.) The automatic placement (display) of the nodes within the viewing window 
involves two phases during which all nodes of the network are graphically displayed to the user. 
(See, Huffaker, page 4.) The first phase of the node placement involves the central positioning 
of a subset of nodes referred to as "root nodes." (See, Huffaker, page 4.) These root nodes are 
displayed within the viewing window in a circular fashion, or positioned based to a coordinate 
system. (See, Huffaker, page 4.) 

9. Following display of the root nodes, so called "non-root nodes" attached to the root nodes 
are also displayed within the viewing window. (See, Huffaker, page 4.) The non-root nodes are 
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displayed "without geographic coordinate information in semi-circles around their parent [root] 
node." (See, Huffaker, page 4.) The children or grandchildren of a root node are displayed at 
varying distances from the root node so that all children and grandchildren of the root node may 
be displayed in the viewing window without overlapping one another. (See, Huffaker, page 4.) 

10. Once all root and non-root nodes have been displayed, a user may customize or adjust the 
display in a variety of manners. For example, a user may "change the status of nodes (i.e., 
turning non-root nodes into roots and vice versa, moving nodes or sub-trees around, and focusing 
on a specific region of the graph" via zoom functions. (See, Huffaker, pages 4-7.) Furthermore, 
in certain aspects of the Huffaker system, a user may color code nodes, links, and/or paths based 
on their attributes. (See, Huffaker, page 8.) This coloring may be completed via a "Color-by" 
pull down menu. (See, Huffaker, page 1 1 ; FIG. 11.) 

11. Khanolkar is directed to an entirely different application than that described above with 
reference to Huffaker. In particular, Khanolkar is directed to a "computer system for detecting 
and monitoring network intrusion events from log data received from network service devices." 
(See, Khanolkar, Abstract.) An intrusion event refers to "any type of security breach and 
accidental or inadvertent misuse." (See, Khanolkar, col. 2, lines 5-8.) 

12. Log data refers to the record of events, such as intrusion events, that occur in a computer 
system. (See, Khanolkar, col. 1, lines 38-40.) Such log data may comprise a large amount of 
information due to the fact that numerous events are recorded by a computer system. (See, 
Khanolkar, col. 2, lines 10-44.) The monitoring system of Khanolkar uses such log data to 
determine if an intrusion event has occurred. More specifically, the log data from a group of 
networked devices is continually provided to the security monitoring system. (See, Khanolkar, 
col. 2, lines 10-44.) Due to the large amount information that is provided, the monitoring system 
filters the log data for data related to intrusion events. (See, Khanolkar, col. 2, lines 10-44.) In 
certain aspects of Khanolkar, a "user may set filters that regulate the type [or] amount of log data 
received, limiting what passes the filter to only particular sources, particular event types, and/or 
particular protocols." (See, Khanolkar, col. 2, lines 40-44.) 

13. Using the data that passes through these first filters, an event object is created for each 

intrusion event. (See, Khanolkar, col. 2, lines 10-44.) "Each event object that is created is read, 
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and the intrusion event information it contains is assigned a security level." (See, Khanolkar, 
col. 2, lines 45-55.) Only those event objects having a security level that meets or exceeds a 
certain threshold level are displayed as an intrusion alarm to the user via a display screen. (See, 
Khanolkar, col. 2, lines 45-55.) 

14. In light of the teachings of Huffaker and Khanolkar, the above alleged justification 
provided by the Examiner clearly does not provide a rational underpinning to explain the 
proposed combination. As explained above, the system of Huffaker incorporates software 
elements that permit a user to customize the viewing window, including zooming, node 
customization, etc. (See, Huffaker, pages 5-8.) For example, in certain embodiments of 
Huffaker, a user may perform an incremental graph display. (See, Huffaker, page 9.) This "step- 
by-step" capability permits "the user to draw the graph incrementally from the root nodes out 
toward the leaves of the topology one "level" at a time." (See, Huffaker, page 9.) Due to these 
various software capabilities disclosed in Huffaker, Applicants assert that the system of Huffaker 
already permits a user to "focus on a particular set of devices" either by zooming or by viewing 
nodes "step-by-step" fashion. As such, Applicants submit that it is unreasonable to assert that 
one of ordinary skill in the art would seek to incorporate the filtering system of Khanolkar into 
Huffaker merely to provide a redundant method for focusing on a particular set of devices. 

15. Furthermore, the motivation provided by the Examiner is irrational in view of the fact 
that the filters of Khanolkar are incapable of functioning for the purpose alleged by the 
Examiner. As noted above, the filters of Khanolkar are designed to filter a large amount of data, 
and pass through data indicative of a security intrusion event. (See, Khanolkar, col. 2, lines 10- 
55.) However, the system of Huffaker is totally unrelated to this concept of filtering log data for 
intrusion event information. Rather, Huffaker merely discloses displaying nodes of a network in 
a viewing window. (See, Huffaker, page 4.) The Examiner has failed to show how the log data 
filters of Khanolkar would function to "allow one to focus on a particular set of devices" in a 
system that merely displays nodes of a network via a viewing window. Applicants respectfully 
assert that one of ordinary skill in the art could not reasonably assert that such intrusion event 
filters would function as alleged by the Examiner. 
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16. The above cited case law makes it extremely clear that without a clear, articulated reason 
having some rational underpinning to explain the proposed combination, an obviousness 
rejection under 35 U.S.C. §103 cannot be maintained. (See KSR, 111 S.Ct. at 1741.) Because, as 
explained above, the Examiner has completely failed to provide any rational underpinning to 
justify the proposed combination, Applicants assert that the proposed combination of Khanolkar 
with Huffaker is prima facie improper. As such, Applicants request that the rejection of claim 1 
under 35 U.S.C. §103 be reconsidered, and that it be withdrawn. 

17. Furthermore, because the Examiner has not provided any sound basis or support to justify 
the proposed combinations, it is clear that the Examiner is relying on information within the 
personal knowledge of the Examiner. Accordingly, Applicants request that the Examiner 
provide an Affidavit/Declaration under 37 C.F.R. § 1.104(d)(2) supporting these statements of 
fact that are within the personal knowledge of the Examiner and upon which the Examiner has 
relied on in finding motivation for combining Khanolkar with Huffaker. 

The Proposed Combination Still Does not Contain 
All Elements of Applicants' Claim 1 

18. Even if the references were modified in the manner proposed by the Examiner, the 
resulting combination would still fail to disclose all elements of the present invention as recited 
in claim 1 . As recognized by the Examiner, Huffaker completely fails to teach or suggest "filter 
criteria, including a selection of at least one of the network device types and at least one of said 
status levels" as recited in claim 1 . Instead, the Examiner asserts that such elements are taught 
by Khanolkar. Applicants respectfully submit that Khanolkar fails to teach that which is asserted 
by the Examiner. 

19. As noted above, Khanolkar is directed to a monitoring system that continually receives a 
large amount of log data from one or more networked devices. (See, Khanolkar, col. 2, lines 10- 
44.) Filters set by the user, or set by the monitoring system, are used to continually filter this 
received data to determine if any intrusion events have occurred. (See, Khanolkar, col. 2, lines 
10-44.) If an intrusion event is detected, another set of filters may be provided to determine of 
the intrusion event is serious enough to display to a user. (See, Khanolkar, col. 2, lines 45-55.) 
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If an intrusion event passes through these filters, an alarm is displayed to the user. (See, 
Khanolkar, col. 2, lines 45-55.) As such, the filters of Khanolkar are merely filters used to 
continually monitor the large amounts of log data, and merely allow data that meets certain 
standards to pass through. The nature of the filters of Khanolkar stem from the fact that the 
system is a "monitoring system," indicating that when the system is operating, the filters must be 
in constant use to determine if an intrusion event has occurred. 

20. Applicants respectfully assert that these filters disclosed in Khanolkar fail to teach 
"selectively applying said selected plurality of filter criteria to retrieve network device 
information related to the plurality network devices in said one or more networks which satisfy 
said selected plurality of filter criteria" as recited, in part, in claim 1. (Emphasis added). As 
noted, the filters of Khanolkar are not "selectively" applied, but rather are used to continually 
monitor a large, steady stream of data. One of ordinary skill in the art would not reasonably 
assert that the system of Khanolkar, having continually monitoring filters, teaches a method 
comprising: "selectively applying said selected plurality of filter criteria" as recited, in part, in 
claim 1. (Emphasis added). As such, because Khanolkar, Huffaker, and the other art of record, 
fail to teach or suggest this element of claim 1, Applicants assert that the rejection of claim 1 is 
prima facie improper. 

The Rejection of Independent Claim 14 is Improper 

21. For at least the reasons discussed above with reference to claim 1, Applicants submit that 
the combination of Huffaker and Khanolkar is prima facie improper. Specifically, the Examiner 
has ignored recent Supreme Court legal precedent by failing to provide "some articulated 
reasoning with some rational underpinning to support the legal conclusion of obviousness." 
(SeeKSR, 111 S.Ct. at 1741.) 

22. Applicants further assert that, for at least the reasons discussed above with reference to 
claim 1 , even if the references were combined as suggested by the Examiner, the combination 
would still lack all elements of the claimed invention as recited in claim 14. Specifically, the 
proposed combination would still fail to teach or suggest "[a] network management node... 
comprising. . . a plurality of modules are operable to. . . receive a user selection of the plurality of 
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filter criteria, including a selection of at least one of the network device types and at least one of 
said status levels... [and] selectively apply said selected plurality of filter criteria to retrieve 
network device information based on said filter information from said database" as recited, in 
part, in claim 14. 

23. Therefore, for at least these additional reasons, Applicants respectfully submit that the 
rejection of claim 14 is improper. As such, Applicants respectfully request that the rejection of 
claim 14 be reconsidered, and that it be withdrawn. 

The Rejection of Independent Claim 1 7 is Improper 

24. For at least the reasons discussed above with reference to claim 1, Applicants submit that 
the combination of Huffaker and Khanolkar is prima facie improper. Specifically, the Examiner 
has ignored recent Supreme Court legal precedent by failing to provide "some articulated 
reasoning with some rational underpinning to support the legal conclusion of obviousness." 
(SeeKSR, 111 S.Ct. at 1741.) 

25. Applicants further assert that, for at least the reasons discussed above with reference to 
claim 1 , even if the references were combined as suggested by the Examiner, the combination 
would still lack all elements of the claimed invention as recited in claim 17. Specifically, the 
proposed combination would still fail to teach or suggest "selectively applying said selected 
plurality of filter criteria to retrieve network device information based on said selected filter 
criteria" as recited, in part, in claim 17. 

26. Therefore, for at least these additional reasons, Applicants respectfully submit that the 
rejection of claim 17 is improper. As such, Applicants respectfully request that the rejection of 
claim 14 be reconsidered, and that it be withdrawn. 

The Rejection of Claim 30 under 35 U.S.C §102 is Improper 

27. As noted above, the Examiner has rejected claim 30 under 35 U.S.C. Section 102(a) as 
anticipated by Huffaker. Applicants respectfully disagree and submit that for at least the reasons 
discussed above with reference to claim 1, Huffaker, Khanolkar or the art of record fails to teach 
all elements of Applicants' amended claim 30. Specifically, Applicants assert that the art of 
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record fails to teach or suggest "displaying on a display a plurality of filter criteria, wherein the 
plurality of filter criteria comprises a selectable list of a plurality of status levels; receiving a user 
selection of one or more of the plurality of filter criteria, including a selection of at least one of 
said status levels; selectively applying said selected plurality of filter criteria to retrieve network 
device information related to the plurality network devices in said one or more networks which 
satisfy said selected plurality of filter criteria" as recited in claim 30. 

28. Therefore, for at least this reason, Applicants submit that claim 30 is patentable over the 
art of record. As such, Applicants respectfully request that the rejection of claim 30 under 35 
U.S.C. §102 be reconsidered, and that it be withdrawn. 

Dependent Claims 

29. The dependent claims incorporate all of the subject matter of their respective independent 
claims and add additional subject matter which makes them a fortiori independently patentable 
over the art of record. Accordingly, Applicants respectfully request that the outstanding 
rejections of the dependent claims be reconsidered and withdrawn. 
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Conclusion 

30. In view of the foregoing, this application should be in condition for allowance. A notice 
to this effect is respectfully requested. 

31. Applicants reserve the right to pursue any cancelled claims or other subject matter 
disclosed in this application in a continuation or divisional application. Thus, cancellations and 
amendments of above claims, are not to be construed as an admission regarding the patentability 
of any claims. 

Respectfully submitted, 

By /Michael G. Verga/ 

Michael G. Verga 

Registration No .: 3 9,4 1 0 
CONNOLLY BOVE LODGE & HUTZ LLP 
1875 Eye Street, NW 
Suite 1100 

Washington, DC 20006 
(202) 331-7111 
(202) 293-6229 (Fax) 
Attorney for Applicants 



Dated: January 31, 2008 
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